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Claims 

1 . Method for creating and managing multilateral contractual relationships among 
contracting parties under a privacy standard, said contracting parties comprising (1) "covered 
entities" receiving data of customers and creating, recording, using, and disclosing private data 
of such customers in the ordinary course of business, and (2) "business associates" requiring the 
use of said private data, said method comprising the steps of: 

(a) assigning digital identities to the contracting parties; 

(b) providing.a multilateral Master Business Associate Contract (MBAC) 
template having non-negotiable terms requiring observation of said privacy standard with 
respect to said private data of a customer; 

(c) providing an electronic interface accessible to said digital identities to 
facilitate negotiating and entering binding multilateral contractual agreements among at 
least one of said covered entities and a plurality of said business associates pursuant to 
the terms of said MBAC template; and 

(d) storing said multilateral contractual agreements in an MBAC database. 

2. The method according to Claim 1, including the additional step of providing self- 
certification provisions in said MBAC for contracting parties to certify adherence to said privacy 
standard as self-certified covered entities or as self-certified business associates. 

3. The method according to Claim 1 , wherein said electronic interface includes interactive 
means for negotiating additional terms with respect to use or disclosure of said private data. 

4. Method for creating and managing multilateral contractual relationships among 
contracting parties under a privacy standard, said contracting parties comprising (1) "covered 
entities" receiving data of customers and creating, recording, using, and disclosing private data 
of such customers in the ordinary course of business, and (2) "business associates" requiring the 
use of said private data, said method comprising the steps of: 
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(a) assigning digital identities to the contracting parties; 

(b) providing a multilateral Master Business Associate Contract (MB AC) 
template having non-negotiable terms requiring observation of said privacy standard with 
respect to said private data of a customer; 

(c) providing self-certification procedures for contracting parties to certify 
adherence to said privacy standard as self-certified covered entities or as self-certified 
business associates; 

(d) providing an electronic interface accessible to said digital identities to 
facilitate negotiating and entering binding multilateral contractual agreements among at 
least one of said self-certified covered entities and a plurality of said self-certified 
business associates pursuant to the terms of said MBAC template; and 

(e) storing said multilateral contractual agreements in an MBAC database. 

5. The method according to Claim 4, wherein said self-certification procedures comprise the 
additional steps of: 

providing a self-certification standard affidavit template for self-certification by 
electronic signature; and 

storing affidavits corresponding to said template in a separate self-certification 
database. 

6. The method according to Claim 4, wherein said self-certification procedures comprise 
warranty clauses in said MBAC. 

7. The method according to Claim 4, wherein said electronic interface includes interactive 
means for negotiating said additional terms with respect to use or disclosure of said private data. 

8. The method according to Claim 4, wherein said interactive means includes means for a 
covered entity to offer and for a business associate to accept said non-negotiable terms in the 
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MBAC. 

9. The method according to Claim 4 including the additional step of: 

accessing a selected multilateral contractual agreement in said MBAC database 
for permission to disclose selected private data to a selected self-certified business 
associate. 

1 0. The method according to Claim 4, wherein said electronic interface comprises the 
internet. 

1 1 . Method for creating and managing multilateral contractual relationships among 
contracting parties under a privacy standard applicable to protected health information (PHI), 
said contracting parties comprising (1) "covered entities" receiving data of customers and 
creating, recording, using, and disclosing PHI data of such customers m the ordinary course of 
business, and (2) "business associates" requiring the use of said PHI data, said method 
comprising the steps of: 

(a) assigning digital identities to the contracting parties; 

(b) providing a multilateral Master Business Associate Contract (MBAC) 
template having non-negotiable terms requiring observation of said privacy standard with 
respect to said PHI data of a customer; 

(c) providing a self-certification standard affidavit template for contracting parties 
to certify adherence to said privacy standard as self-certified covered entities or as self- 
certified business associates by electronic signature so as to achieve self-certification; 

(d) storing affidavits corresponding to said template in a separate self-certification 
database; 

(e) providing an electronic interface accessible to said digital identities, said 
electronic interface being selectively connectable to the self-certification database to 
facilitate negotiating and entering binding multilateral contractual agreements among at 
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least one of said self-certified covered entities and a plurality of said self-certified 
business associates pursuant to the terms of said affidavits and said MBAC template; and 
(f) storing said multilateral contractual agreements in an MBAC database. 

12. The method according to Claim 1 1 , wherein said electronic interface includes interactive 
means for negotiating said additional terms with respect to use or disclosure of said PHI data. 

13. The method according to Claim 1 1 , wherein said interactive means includes means for a 
covered entity to offer and for a business associate to accept said non-negotiable terms in the 
MBAC. 

14. The method according to Claim 1 1 including the additional step of: 

accessing a selected multilateral contractual agreement in said MBAC database 
for permission to disclose selected PHI data to a selected self-certified business associate. 

1 5. The method according to Claim 1 1 , wherem said electronic interface comprises the 
mtemet. 
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